Meta Box AIO WordPress Plugin Vulnerability: Critical CVE-2026-14488
The Meta Box AIO plugin for WordPress is reportedly vulnerable to a critical Missing Authorization issue, allowing unauthenticated attackers to delete arbitrary posts and pages. Users of versions <=3.8.0 are advised to upgrade immediately.
What happened
An early warning has been issued regarding a critical vulnerability, tracked as CVE-2026-14488, affecting the Meta Box AIO plugin for WordPress. The vulnerability, which has a CVSS score of 9.1, appears to allow unauthenticated attackers to delete arbitrary posts and pages via the template_redirect dispatcher in the MB Frontend Submission extension. This issue impacts versions of the Meta Box AIO plugin up to and including 3.8.0.
The recommended action for affected users is to upgrade the Meta Box AIO plugin to a version beyond 3.8.0 as soon as possible. Additionally, it is advised to review any deleted content for signs of suspicious activity. The vulnerability is under investigation, and further details may become available as the situation develops. For the most current information, consult the primary sources linked in the threat data.
How 0Day mitigates this
meta box aio plugin is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.